Subdomain policy (sp=)
DMARC's sp= tag sets the policy receivers apply to mail from your subdomains, such as billing.example.com or any name under your domain, whether or not you use it.
The four settings
| Setting | Published as | Subdomain mail that fails DMARC |
|---|---|---|
| Inherit (follow p=) | no sp tag | gets whatever p= says |
| None | sp=none | is delivered, whatever p= says |
| Quarantine | sp=quarantine | goes to spam |
| Reject | sp=reject | is refused |
The record's pct applies to subdomain mail as well.
What your domain starts with
- New domains publish no
sptag, so subdomains followp=. While you monitor, they are monitored; as your policy climbs, they climb with it. - Domains set up before October 2026 carry
sp=none, and keep it until you choose otherwise. Nothing is changed for you.
Raising p also checks subdomain senders
When subdomains inherit, every step up of p raises them too, so the readiness check also looks at the mail your identified senders send from subdomains. A sender failing from a subdomain blocks the step, and the page names both the sender and the subdomain. An explicit sp you keep unchanged is not re-checked when p moves.
The sp=none warning
If your live record enforces (p=quarantine or p=reject) but says sp=none, the DMARC page shows "sp=none: subdomains unprotected". Any name under your domain can then be used to send mail that fails DMARC, and receivers deliver it. Use Protect Subdomains on the rail to fix it. Once your domain is at Reject 100%, the rail recommends a subdomain policy as the next step.
How we know your subdomains
Only from your reports: each report row names the From domain of the mail it counts, so a subdomain appears once mail has been sent from it. DNS cannot list the subdomains of a domain. DNS is used only to check whether a subdomain we already know of publishes its own _dmarc record, which takes precedence over sp= for that subdomain.
The DMARC page lists the subdomains that sent mail as you in the last 14 days and what policy applies to each.